A big data transaction security management method and system

Abstract

This application relates to the field of financial information management technology, and provides a method and system for big data transaction security control. The method involves acquiring user information and transaction data streams from both parties; generating a dynamic quantum key from the polarization basis sequences selected by both parties; encrypting the transaction data stream with the dynamic quantum key to generate encrypted ciphertext; dynamically de-identifying the user information and transaction data stream based on an entity relationship network constructed from the transaction data stream and role information in the user information to obtain de-identified data; training a transaction risk identification model using federated learning based on the encrypted ciphertext and the de-identified data; determining the risk probability based on the acquired real-time transaction characteristics using the risk identification model; and generating a security control strategy based on the risk probability. By utilizing quantum encryption technology to protect data security and privacy, and generating precise security control strategies based on real-time transaction characteristics, the security, privacy, and reliability of transactions are significantly improved.

Description

Technical Field

[0001] This application relates to the field of financial information management technology, and more specifically, to a method and system for big data transaction security control. Background Technology

[0002] With the acceleration of digitalization, data has become a core production factor, especially in sectors such as finance, healthcare, and e-commerce, where the scale of data transactions is growing rapidly. However, the high value of data has also given rise to various security threats. Large-scale data transactions involve sensitive information such as user identities, transaction records, and health data, and cross-institutional and cross-platform data sharing requires ensuring data privacy. While enhancing their market competitiveness, financial institutions also face increasingly difficult-to-prevent transaction risks. To address these risks, financial institutions need to establish effective transaction security control systems.

[0003] In practical applications, data collected by big data systems is typically stored in the cloud, which can pose potential security threats. If the stored data is not encrypted and lacks appropriate data security measures, data breaches are likely to occur. Therefore, there is a problem of both low data security and low accuracy in transaction security management. Summary of the Invention

[0004] This application provides a method and system for big data transaction security management, which can at least to some extent solve the problem of low data security and low management accuracy in the process of transaction security management.

[0005] Other features and advantages of this application will become apparent from the following detailed description, or may be learned in part from practice of this application.

[0006] According to one aspect of this application, a method for big data transaction security management is provided, comprising: acquiring user information and transaction data streams of both parties to a transaction, wherein the transaction data streams include structured and unstructured transaction data; generating a dynamic quantum key from polarization basis sequences selected by both parties to the transaction, and encrypting the transaction data streams using the dynamic quantum key to generate encrypted ciphertext; dynamically desensitizing the user information and transaction data streams based on an entity relationship network constructed from the transaction data streams and role information in the user information to obtain desensitized data; training a transaction risk identification model using federated learning based on the encrypted ciphertext and the desensitized data; determining the risk probability using the risk identification model based on the acquired real-time transaction characteristics, and generating a security management strategy based on the risk probability.

[0007] In this application, based on the aforementioned scheme, obtaining the user information and transaction data stream of both parties to the transaction includes: obtaining the user information and real-time transaction requests of both parties from a mobile application or POS terminal; and obtaining the transaction data stream from a payment platform. In this application, based on the aforementioned scheme, generating a dynamic quantum key from the polarization basis sequence selected by both parties to the transaction, and encrypting the transaction data stream using the dynamic quantum key to generate encrypted ciphertext includes: generating a dynamic quantum key from the polarization basis sequence selected by both parties to the transaction through quantum polarization state transmission; hashing the dynamic quantum key to generate hash parameters; and encrypting the transaction data stream using the hash parameters to generate encrypted ciphertext.

[0008] In this application, based on the aforementioned scheme, the dynamic desensitization of the user information and transaction data stream, based on the entity relationship network constructed from the transaction data stream and the role information in the user information, to obtain desensitized data, includes: parsing the data semantics based on the transaction data stream to construct an entity relationship network participating in the transaction; identifying the data sensitivity level based on the context information of the entity relationship network and the transaction data stream; generating a desensitization strength coefficient based on the role information in the user information and the data sensitivity level; and performing desensitization processing on the transaction data stream based on the comparison result between the desensitization strength coefficient and a set threshold to generate desensitized data.

[0009] In this application, based on the aforementioned scheme, the step of training a transaction risk identification model using federated learning based on the encrypted ciphertext and the de-identified data includes: decrypting the encrypted ciphertext to generate decrypted data; inputting the decrypted data and the de-identified data into a trusted execution environment, training a local model based on a loss function to generate local model weights; submitting the hash value of the local model weights to the blockchain in the trusted execution environment, and verifying the security of the local model weights by calling a verification function through a smart contract on the blockchain to obtain a first weight that has passed verification; aggregating the first weights to generate aggregate weights, and constructing a global risk identification model based on the aggregate weights.

[0010] In this application, based on the aforementioned scheme, the step of determining the risk probability through the risk identification model based on the acquired real-time transaction features, and generating a security control strategy based on the risk probability, includes: determining the data type corresponding to the acquired real-time transaction features; sending the real-time transaction features to the corresponding model according to the data type, and obtaining the output result of the corresponding model; processing the output result through a dynamic attention mechanism to generate the risk probability; and generating a security control strategy based on the risk probability.

[0011] In this application, based on the aforementioned scheme, the step of generating a security control strategy according to the risk probability includes: obtaining anomaly scores of historical behavior of transaction users; generating a comprehensive risk index and determining a dynamic risk level based on the risk probability, the transaction amount in the transaction data stream, and the anomaly scores; and selecting a security control strategy from a preset strategy library based on the dynamic risk level.

[0012] According to one aspect of this application, a big data transaction security management system is provided, comprising:

[0013] The acquisition unit is used to acquire user information and transaction data streams of both parties to the transaction, wherein the transaction data streams include structured and unstructured transaction data;

[0014] An encryption unit is used to generate a dynamic quantum key from the polarization basis sequence selected by the two parties to the transaction, and to encrypt the transaction data stream using the dynamic quantum key to generate encrypted ciphertext;

[0015] The desensitization unit is used to dynamically desensitize the user information and transaction data stream based on the entity relationship network constructed by the transaction data stream and the role information in the user information to obtain desensitized data;

[0016] The training unit is used to train a transaction risk identification model based on the encrypted ciphertext and the de-identified data through federated learning.

[0017] The control unit is used to determine the risk probability based on the acquired real-time transaction characteristics through the risk identification model, and generate a security control strategy based on the risk probability.

[0018] According to one aspect of this application, a computer-readable medium is provided having a computer program stored thereon, which, when executed by a processor, implements the big data transaction security management method as described in the above embodiments.

[0019] According to one aspect of this application, an electronic device is provided, comprising: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the big data transaction security management method as described in the above embodiments.

[0020] According to one aspect of this application, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the big data transaction security management method provided in the various optional implementations described above.

[0021] In the technical solution of this application, user information and transaction data streams of both parties to a transaction are obtained. A dynamic quantum key is generated from the polarization basis sequence selected by both parties. The transaction data stream is then encrypted using the dynamic quantum key to generate encrypted ciphertext. Based on the entity relationship network constructed from the transaction data stream and the role information in the user information, the user information and transaction data stream are dynamically de-identified to obtain de-identified data. Based on the encrypted ciphertext and the de-identified data, a transaction risk identification model is generated through federated learning. Based on the acquired real-time transaction characteristics, the risk probability is determined using the risk identification model, and a security control strategy is generated based on the risk probability. By utilizing quantum encryption technology to protect data security and privacy, and generating precise security control strategies based on real-time transaction characteristics, comprehensive, real-time, and precise security control of transaction behavior is achieved, significantly improving the security, privacy, and reliability of transactions, and providing financial institutions with an effective risk prevention method.

[0022] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0023] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0024] Figure 1 The flowchart illustrating a big data transaction security control method in one embodiment of this application is shown in the illustration.

[0025] Figure 2 The flowchart illustrating the generation of encrypted ciphertext is shown in one embodiment of this application.

[0026] Figure 3 The illustration shows a schematic diagram of a big data transaction security management system in one embodiment of this application.

[0027] Figure 4 A schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application is shown. Detailed Implementation

[0028] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided to make this application more comprehensive and complete, and to fully convey the concept of the exemplary embodiments to those skilled in the art.

[0029] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this application. However, those skilled in the art will recognize that the technical solutions of this application can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this application.

[0030] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0031] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0032] The implementation details of the technical solution of this application are described below:

[0033] Figure 1 A flowchart illustrating a big data transaction security control method according to an embodiment of this application is shown. (Refer to...) Figure 1 As shown, this big data transaction security control method includes at least steps S110 to S150, which are detailed below:

[0034] In step S110, user information and transaction data streams of both parties to the transaction are obtained, and the transaction data streams include structured and unstructured transaction data.

[0035] In one embodiment of this application, obtaining user information and transaction data streams from both parties to the transaction includes: obtaining user information and real-time transaction requests from a mobile application or a point-of-sale (POS) terminal; and obtaining transaction data streams from a payment platform.

[0036] In one embodiment of this application, real-time transaction requests, including information such as transaction amount, time, and geographical location, are obtained from mobile applications, web pages, or POS terminals. Transaction status is captured from connected banks or third-party payment platforms. Simultaneously, the user's historical operations within the platform, such as login frequency, browsing paths, and password change records, are recorded to construct a user behavior profile.

[0037] Optionally, real-time transaction data is transmitted via a message queue to ensure millisecond-level response. Historical behavioral data is periodically imported from the database in batches, while user profiles are updated simultaneously.

[0038] Optionally, user information and transaction data streams can be obtained based on the scope of authorization granted by the transaction user.

[0039] Optionally, the acquired data can be cleaned and normalized to suit subsequent analysis. Obvious erroneous data, such as negative transaction amounts or incorrect timestamp formats, can be automatically identified and removed. Standardized fields, such as unified currency units and time zone conversions, can then be stored in a distributed database.

[0040] Optionally, during the acquisition of user information and transaction data streams from both parties, structured data such as transaction amount, timestamp, user ID, and payment status are collected through a real-time data pipeline. This data is then integrated with payment gateways, databases, and third-party transaction interfaces, utilizing a stream processing engine to capture transaction events and ensure millisecond-level data transmission. Optionally, the structured data is ultimately fed into the risk control engine, providing high-precision input for real-time risk scoring models, such as quickly identifying abnormal consumption patterns by correlating with users' historical transaction records.

[0041] A multimodal processing framework enables deep analysis of unstructured data, such as contract texts, customer service recordings, and operation logs in transaction data streams. Specifically, natural language processing is used to extract key entities from text data, such as transaction terms and risk keywords in contracts; speech data is converted into text through speech recognition and then analyzed for semantic sentiment; and operation logs are identified using optical character recognition (OCR) and classified as abnormal operation screenshots using visual models.

[0042] The acquired data is cleaned and stored in object storage, then transformed into structured feature vectors through a feature extraction layer, and finally integrated with the original transaction data. For example, matching "urgent transfer requests" mentioned in customer service conversations with the same user's transaction records enhances the contextual understanding for risk assessment. Ultimately, the multimodal data stream provides rich input dimensions for the hybrid model, supporting accurate identification of complex risk scenarios.

[0043] The above process acquires user information and transaction data streams from both parties through multiple channels, including mobile applications, POS terminals, and payment platforms, ensuring the comprehensiveness and diversity of the data and providing a rich data foundation for subsequent security management. By acquiring transaction requests and data streams in real time, the security management system can respond quickly to transaction activities and promptly identify and address potential risks.

[0044] In step S120, a dynamic quantum key is generated from the polarization basis sequence selected by both parties to the transaction. The transaction data stream is then encrypted using the dynamic quantum key to generate encrypted ciphertext.

[0045] In one embodiment of this application, based on the extracted identity information of the transacting parties, such as user ID, device fingerprint, and biometric features, this information is used as a seed for generating a quantum key. Utilizing the principles of quantum mechanics, through quantum polarization state transmission or quantum entanglement, a dynamic quantum key closely associated with the transacting parties' user information and unique for each communication is generated. This key is then applied to the encryption process of the transaction data stream. The original transaction data is converted into ciphertext through an encryption algorithm, thereby ensuring the confidentiality, integrity, and authenticity of the transaction data during transmission and storage, effectively preventing the risk of data leakage and tampering.

[0046] like Figure 2 As shown, in one embodiment of this application, a dynamic quantum key is generated from the polarization basis sequence selected by both parties to the transaction. The transaction data stream is then encrypted using the dynamic quantum key to generate encrypted ciphertext, including:

[0047] S210, the polarization basis sequence selected by the two parties to the transaction is used to generate a dynamic quantum key through quantum polarization state transmission;

[0048] S220, perform hash processing on the dynamic quantum key to generate hash parameters;

[0049] S230, the transaction data stream is encrypted using the hash parameter to generate encrypted ciphertext.

[0050] In one embodiment of this application, the transacting parties select a polarization basis sequence and, based on a quantum key distribution protocol, generate an initial key by transmitting the polarization basis sequence through photon polarization state transmission. Simultaneously, a quantum random number generator is used to generate truly random numbers using quantum physical phenomena (such as photon emission time), and a timestamp t is bound to enhance dynamism, thereby generating a dynamic quantum key K. Q for:

[0051]

[0052] Among them, S A ,S BThese represent the polarization basis sequences chosen by the two parties in the transaction, QKD(S) A ,S B ) represents the quantum key distribution process based on quantum key distribution protocols (such as the BB84 protocol), which generates the initial key through the transmission of photon polarization states; QRNG(t) represents a quantum random number generator, which generates truly random numbers using quantum physical phenomena (such as photon emission time) and binds them with timestamp t to enhance dynamism. This represents the XOR operation.

[0053] In practical applications, traditional BB84 protocol keys are statically generated, making them vulnerable to replay attacks. This solution introduces real-time perturbation and a time-varying factor from a quantum random number generator, combining the initial key generated by the quantum key distribution protocol with random numbers from the quantum random number generator. This breaks the key's periodicity, avoids the risk of reuse, and enables the key to have dynamic update characteristics, thus improving its resistance to quantum computing attacks.

[0054] Next, the dynamic quantum key is hashed to generate hash parameters, and the transaction data stream is encrypted using the hash parameters to generate encrypted ciphertext c. i for:

[0055]

[0056] Where, f(K) Q ) represents the hash parameter generated by hashing the key, d i Represents the transaction data stream, e i The error parameter represents the parameter that follows a Gaussian distribution. The integer part represents the integer part, and the mod part represents the modulo part.

[0057] The above process maps data to a high-dimensional space and performs hash operations using a dynamic quantum key, causing the hash parameters to change with the dynamic quantum key. This ensures that each transaction has a unique encryption key, breaking the fixed-parameter attack surface and providing extremely high security and unbreakability. It effectively prevents data from being stolen or tampered with during transmission, thus improving data security.

[0058] In step S130, based on the entity relationship network constructed from the transaction data stream and the role information in the user information, the user information and the transaction data stream are dynamically de-identified to obtain de-identified data.

[0059] In this embodiment, the transaction data stream is parsed to identify and extract the various entities participating in the transaction and the relationships between them, thereby constructing an entity relationship network. This network reveals the connections between the parties involved in the transaction and reflects the data flow path within the transaction process. Simultaneously, by combining user information such as user identity, permission level, and role positioning in the transaction, the sensitivity of the data and the need for data anonymization are comprehensively assessed. Based on these analyses, anonymization strength coefficients are dynamically generated. These coefficients are then used to precisely anonymize sensitive information in the transaction data stream, such as by replacing, masking, or generalizing sensitive data. This ensures that while protecting user privacy and data security, data availability and business logic continuity are maintained as much as possible, ultimately resulting in secure and compliant anonymized data.

[0060] In one embodiment of this application, based on the entity relationship network constructed from the transaction data stream and the role information in the user information, the user information and the transaction data stream are dynamically de-identified to obtain de-identified data, including:

[0061] Based on the transaction data stream, the data semantics are parsed to construct a network of relationships between entities participating in the transaction;

[0062] Data sensitivity levels are identified based on the contextual information of the entity relationship network and the transaction data stream;

[0063] Based on the role information in the user information and the data sensitivity level, a desensitization strength coefficient is generated;

[0064] Based on the comparison between the desensitization intensity coefficient and the set threshold, the transaction data stream is desensitized to generate desensitized data.

[0065] In one embodiment of this application, the transaction data stream contains a large amount of information about the transaction, such as the identities of the transacting parties, the transaction amount, the transaction time, and the traded items. Natural language processing techniques and machine learning algorithms are used to perform deep analysis on this data to identify and understand the semantic information within it. Semantic analysis can identify various entities in the transaction, such as buyers, sellers, and goods, and further analyze the relationships between these entities, such as purchase relationships and payment relationships. Finally, based on these relationships, an entity relationship network is constructed. This network clearly displays the various entities in the transaction and their interrelationships, providing a foundation for subsequent data processing and analysis.

[0066] Secondly, based on the contextual information of the entity relationship network and transaction data flow, the sensitivity level of the data is identified. The sensitivity of the data is assessed by analyzing each node and edge in the entity relationship network, as well as the contextual information in the transaction data flow, such as transaction time, location, and frequency. For example, if a transaction involves a large transfer of funds or sensitive personal information, the data sensitivity level of that transaction will be relatively high. This information is then comprehensively evaluated according to preset sensitivity assessment rules to determine the sensitivity level of each transaction's data.

[0067] Next, an anonymization strength coefficient is generated based on the role information and data sensitivity level in the user information. First, the role information in the user information is obtained, such as whether the user is an administrator, a regular user, or a visitor. Different roles have different access permissions and anonymization requirements. Then, combined with the previously determined data sensitivity level, an anonymization strength coefficient is generated. This coefficient reflects the degree of anonymization required to ensure data security and privacy.

[0068] Finally, based on the comparison between the anonymization strength coefficient and a preset threshold, the transaction data stream is anonymized to generate anonymized data. The anonymization strength coefficient is compared to the preset threshold; if the coefficient is higher, a higher degree of anonymization is applied to the transaction data stream, such as replacing sensitive information or encrypting data. If the coefficient is lower than or equal to the threshold, a lower degree of anonymization is applied, or no anonymization is performed. Ultimately, anonymized data is generated, which retains some informational value while ensuring data security and privacy.

[0069] The above process, through the semantic understanding of knowledge graphs and natural language processing, combined with dynamic adjustment strategies based on user roles, improves the accuracy of sensitive field identification. By constructing entity relationship networks and identifying data sensitivity levels, and generating desensitization strength coefficients based on user roles and data sensitivity levels, sensitive data can be accurately desensitized, making the desensitization process more flexible and personalized, protecting privacy while ensuring data usability.

[0070] In step S140, a transaction risk identification model is generated by training through federated learning based on the encrypted ciphertext and the de-identified data.

[0071] In one embodiment of this application, encrypted ciphertext is securely decrypted to ensure the recovery of the original transaction data characteristics in a trusted execution environment. Simultaneously, the anonymized data is directly used to provide transaction behavior patterns in a non-sensitive context. These two types of data protect user privacy while retaining sufficient information for model learning. Subsequently, within the framework of federated learning, multiple participants (such as different financial institutions or data holders) independently train local models within their respective data domains, based on the same model architecture and loss function, generating local model weights. These local model weights undergo strict privacy protection measures, such as differential privacy or secure multi-party computation, before being uploaded to a central server or a trusted third party like a blockchain, to prevent the leakage of sensitive information. The central server or blockchain is responsible for aggregating these local model weights to form global aggregated weights, and constructing the final transaction risk identification model based on these weights. The transaction risk identification model can learn the general patterns and potential risk characteristics of transaction behavior across different data sources, thereby achieving accurate identification and early warning of transaction risks.

[0072] In one embodiment of this application, a transaction risk identification model is generated by training federated learning based on the encrypted ciphertext and the de-identified data, including:

[0073] The encrypted ciphertext is decrypted to generate decrypted data;

[0074] The decrypted data and the de-identified data are input into a trusted execution environment, and a local model is trained based on a loss function to generate local model weights.

[0075] The hash value of the local model weight is submitted to the blockchain in the trusted execution environment. The verification function is called through the smart contract on the blockchain to verify the security of the local model weight and obtain the first weight that has passed the verification.

[0076] The first weights are aggregated to generate aggregate weights, and a global risk identification model is constructed based on the aggregate weights.

[0077] In one embodiment of this application, the core objective of training a local Trusted Execution Environment (TEE) is to ensure the security of data during decryption and model training. First, each participant (such as a bank or payment institution) needs to deploy a TEE based on hardware isolation technology locally, creating a protected secure enclave. This environment, through hardware encryption and memory isolation technologies, ensures that external access to data and computational processes within the enclave is impossible.

[0078] When encrypted or anonymized data is input, if the data is in ciphertext form, decryption is performed within the enclave using a quantum key distribution. This process is entirely within a secure environment; the key and plaintext data are not exposed to the operating system or other applications, effectively defending against side-channel attacks, such as information theft through power consumption or electromagnetic leakage. The decrypted data is directly used for local model training, and model parameter optimization is also completed within the enclave. During training, the model minimizes the loss function and incorporates regularization terms to avoid overfitting, ultimately generating local model weights.

[0079] In traditional federated learning, data decryption and training may take place in an unprotected environment, posing a risk of data leakage. TEE, on the other hand, uses hardware-level protection to ensure that sensitive data is processed only within a secure enclave. Even if the host system is compromised, attackers cannot access information within the enclave, thus significantly improving privacy and security.

[0080] The goal of blockchain-based verification aggregation is to ensure that the global model is composed solely of legitimate and tamper-proof local model weights. First, after completing local training, each participant submits the hash value of the model weights to the blockchain network. The hash value is generated using an irreversible hash function and uniquely identifies the weight content; any alteration to the weights will result in a change to the hash value.

[0081] The smart contract invokes pre-defined verification logic, such as checking whether the hash value comes from a participant certified by the TEE. Weights that fail verification are directly rejected, such as those from unauthorized devices or tampered models; only legitimate weights are retained as the first weight.

[0082] The verified weights then enter the aggregation phase. Based on the verification results of each participant, the first weights are aggregated to generate the aggregated weights for round t+1 iterations. for:

[0083]

[0084] Where k represents the identifier of the participant in the model training, K represents the total number of participants, and represents... This represents the local model weight of participant k in round t, Hash(·) represents hash operation, and Verify(·) represents verification security processing.

[0085] Unlike traditional methods, which simply average the weights of all nodes, traditional federated learning cannot defend against malicious nodes submitting forged parameters, such as model poisoning attacks. Blockchain verification mechanisms, through hashing on-chain and automated screening via smart contracts, ensure that only trusted weights are aggregated. Furthermore, the immutability of the blockchain records the entire process, significantly improving the model's robustness and resistance to attacks.

[0086] The above process addresses the data leakage risks inherent in traditional federated learning by using hardware-level isolation to protect data decryption and training in local TEE training. Training the model within a trusted execution environment ensures data security and privacy, preventing data breaches. Federated learning leverages data from multiple participants for joint training, improving model accuracy and generalization ability. Blockchain verification aggregation utilizes hashing on-chain and smart contracts to filter legitimate weights, verifying the security of local model weights and preventing malicious nodes from contaminating the global model, thus ensuring model reliability and security. This forms a closed loop of secure computation and trusted verification, achieving efficient and reliable distributed model collaboration while protecting privacy.

[0087] In step S150, based on the acquired real-time transaction characteristics, the risk probability is determined through the risk identification model, and a security control strategy is generated based on the risk probability.

[0088] In one embodiment of this application, based on the acquired real-time transaction characteristics, a pre-trained risk identification model is used for analysis to determine the risk probability of each transaction. This process involves inputting real-time transaction characteristics, such as transaction amount, transaction time, transaction location, user behavior patterns, and device information, into the risk identification model. Machine learning algorithms, such as deep learning or ensemble learning, are used to perform complex data processing and pattern recognition on the input characteristics, thereby outputting a quantified risk probability value, which reflects the likelihood of a potential risk in the transaction. Once the risk probability is determined, corresponding security control strategies are automatically generated according to preset risk thresholds and decision rules. For low-risk transactions, only routine monitoring or recording is performed; while for high-risk transactions, more stringent measures are taken, such as triggering additional identity verification steps, limiting transaction amounts, suspending transactions until manual review, or immediately blocking transactions and notifying the relevant security team for further investigation. The formulation and implementation of these security control strategies aim to ensure the security and compliance of transactions while minimizing interference with normal transaction processes, thereby providing users with a safe and convenient transaction experience.

[0089] In one embodiment of this application, based on the acquired real-time transaction characteristics, a risk probability is determined through the risk identification model, and a security control strategy is generated according to the risk probability, including:

[0090] Based on the acquired real-time transaction characteristics, determine the data type corresponding to the real-time transaction characteristics;

[0091] The real-time transaction features are sent to the corresponding model according to the data type, and the output results of the corresponding model are obtained;

[0092] The output is processed using a dynamic attention mechanism to generate risk probabilities.

[0093] A security management strategy is generated based on the stated risk probability.

[0094] In one embodiment of this application, a hybrid model architecture integrates three different machine learning models to comprehensively analyze transaction risks. First, structured data is processed by the distributed gradient boosting library model XGBoost. Distributed gradient boosting libraries excel at capturing complex interactions between structured features, such as identifying potential risks associated with combinations of high-value transactions and uncommon IP addresses. Second, unstructured text data is input into a deep learning model. The deep learning Transformer model extracts key information through semantic analysis, such as identifying high-risk clauses implicit in contracts or abnormal operation descriptions in logs. Third, time-series data (such as transaction timestamps and user historical behavior) is processed by a Long Short-Term Memory (LSTM) network model, which can capture continuous temporal patterns, such as the abnormal rhythm of frequent transactions within a short period.

[0095] The outputs of these three models are not simply added together, but intelligently fused through a dynamic attention mechanism. The weights of each model are automatically adjusted based on the specific characteristics of the current transaction. For example, when the transaction amount exceeds a preset first threshold, the weight of XGBoost increases, emphasizing the importance of structured features such as amount and IP address; if the complexity of the contract text involved in the transaction exceeds a preset second threshold, the weight of Transformer is enhanced to focus on semantic analysis results; and if the transaction time interval is less than a preset third threshold and conforms to historical anomaly patterns, the weight of LSTM is increased. This adjustment based on a dynamic attention mechanism allows each model to flexibly adapt to different scenarios, avoiding the limitations of a single modality, and ultimately outputting a comprehensive risk probability (between 0 and 1), with a higher score representing greater risk.

[0096] In addition, spatiotemporal correlation analysis identifies coordinated attack patterns across time and space. First, the similarity of features between different transactions is calculated, such as comparing the similarity of the initiating device, geographical location, or operational behavior. If two transactions originate from the same device and their behavioral patterns are highly consistent, the similarity is considered high. Next, the system introduces spatiotemporal correlation parameters to evaluate the time interval between transactions. For example, multiple transactions initiated consecutively from the same network address within 5 minutes have a short time interval and strong correlation; while transactions spaced several hours apart are considered to have low correlation.

[0097] Specifically, in order to identify cross-platform and cross-time collaborative attack patterns, the spatiotemporal correlation parameter A between transaction features is calculated. ij for:

[0098]

[0099] Where i, j, and k represent the identifiers of transaction features, n represents the total number of transaction features, τ represents the hyperparameter controlling the attention distribution, λ represents the time decay factor, and t i t j This represents the timestamps of transactions i and j. The ability of the model to capture spatiotemporal anomalies is enhanced by calculating spatiotemporal correlation parameters. For example, if the same IP initiates multiple high-value transactions within a short period, with short time intervals and high feature similarity, then A... ij The value is relatively large, triggering a risk warning.

[0100] By combining spatiotemporal correlation parameters and time decay, a correlation weight is generated for each pair of transactions. Transactions with high weights are marked as potential coordinated attacks, such as multiple accounts performing the same operation within a short period of time in a distributed denial-of-service attack. This process can not only detect anomalies in individual transactions but also capture cross-platform and cross-temporal attack chains that traditional methods overlook. For example, attackers may use multiple accounts to operate at different times, but through spatiotemporal correlation analysis, implicit correlations between these accounts in terms of characteristics and time can still be identified, thus providing early warnings.

[0101] Ultimately, the spatiotemporal analysis results are combined with the risk probabilities of the hybrid model to further optimize the overall judgment. This multi-dimensional analysis significantly improves the detection rate of complex attack patterns, while filtering out random correlations through a time decay mechanism to reduce the risk of false alarms.

[0102] The above process, based on real-time transaction characteristics, determines the probability of risk, enabling the security control system to respond quickly to changes in trading behavior. Processing the output through a dynamic attention mechanism allows for more accurate assessment of trading risks, improving the accuracy of risk identification. Generating security control strategies based on risk probabilities makes strategy formulation more flexible and personalized, allowing for different control measures to be taken for different risk levels.

[0103] In one embodiment of this application, a security control strategy is generated based on the risk probability, including:

[0104] Obtain anomaly scores for historical behavior of trading users;

[0105] Based on the risk probability, the transaction amount in the transaction data stream, and the anomaly score, a comprehensive risk index is generated, and a dynamic risk level is determined.

[0106] Based on the dynamic risk level, a security control strategy is selected from a preset strategy library.

[0107] In one embodiment of this application, transaction risk is first dynamically assessed by integrating multi-dimensional information. The risk probability is derived from the output of a multimodal model and weighted by factors such as the specific characteristics of the current transaction (e.g., transaction amount), user historical behavior (e.g., abnormal ratings of the user's historical behavior), and real-time system status (e.g., server load) to generate a comprehensive risk index. For example, if a large transfer originates from an unfamiliar device and the user has recent suspicious login records, the comprehensive risk index will increase significantly.

[0108] After generating the comprehensive risk index, the current threshold is calculated. The dynamic risk level is determined by comparing the comprehensive risk index with the current threshold. Specifically, in this embodiment, the risk threshold is dynamically adjusted based on the real-time environment. The current threshold θ is determined as follows:

[0109]

[0110] Where, θ base L and L represent the preset base thresholds. max These represent the system's real-time load and maximum load capacity, respectively; λ represents the attenuation coefficient, which decreases with higher attack frequency; T attack This indicates the frequency of recent attacks, such as the number of high-risk transactions in the past hour.

[0111] For example, during peak periods or when a recent increase in attack frequency is detected, the high-risk threshold is automatically lowered to more strictly block suspicious transactions; conversely, the threshold is appropriately relaxed during low-load periods to reduce interference with normal users. This dynamic adjustment ensures that the strategy can cope with sudden attacks while avoiding over-defense.

[0112] Based on risk level and transaction characteristics, specific control actions are matched from a predefined strategy library. The strategy library is built according to dimensions such as risk level, transaction type, and user trustworthiness. For example, for high-risk cross-border payments, if the transaction amount is large and originates from a high-risk region, the system will immediately freeze the account, trigger manual review, and simultaneously notify the risk control team. For medium-risk large-amount transfers, if the user's device is trustworthy but the transaction time is abnormal (e.g., early morning), the system will require secondary verification (e.g., facial recognition) and delay the transaction for 5 minutes to observe subsequent behavior. For low-risk small-amount consumption, only logs are recorded, and the transaction is allowed to proceed normally.

[0113] In addition, for edge cases (such as when the risk score is close to a threshold), the system employs a progressive verification mechanism. For example, when a user logs in for the first time on a new device, an SMS verification code is sent first; if the verification fails, it is upgraded to biometric verification, gradually increasing the verification strength to balance security and user experience.

[0114] Optionally, after each control action is executed, the system collects feedback data, such as whether fraud was successfully intercepted and whether users appealed false alarms, and continuously optimizes the strategy based on this information. For example: when interception is successful, the application weight of the current strategy in similar scenarios is strengthened; when false alarms occur, the sensitivity of relevant risk parameters is reduced to avoid repeated misjudgments; when missed alarms occur, the model threshold is adjusted or new risk features are added to improve detection sensitivity. Through an automated learning mechanism, pattern changes (such as new attack methods) in historical data are analyzed regularly to dynamically update the strategy library. For example, if a phishing attack targeting a specific payment channel is detected recently, the system will temporarily increase the risk weight of such transactions and add verification steps.

[0115] For example, an attacker manipulates multiple accounts to initiate small-amount transfers within a short period. The system, through spatiotemporal correlation analysis, discovers that these transactions originate from different devices but have concentrated IP addresses and occur within extremely short time intervals, thus classifying it as a coordinated attack. Even if a single transaction has a moderate risk score, the system will still intercept them in batches and trigger a global risk alert.

[0116] The above process adjusts thresholds and strategies in real time according to the environment, avoiding false positives or false negatives caused by a "one-size-fits-all" approach. It matches differentiated management actions to different transaction types and user profiles, balancing security and efficiency. Through a feedback loop, it continuously optimizes strategies to adapt to new attack methods and changes in user behavior. By transforming abstract risk scores into concrete, actionable security actions, it makes strategy formulation more dynamic and flexible, adapting to changes in different trading scenarios and risk levels. This enables precise risk control in complex and ever-changing trading environments while maximizing user experience.

[0117] This application's technical solution acquires user information and transaction data streams from both parties in a transaction; generates a dynamic quantum key from the polarization basis sequences selected by both parties; encrypts the transaction data stream using the dynamic quantum key to generate encrypted ciphertext; dynamically desensitizes the user information and transaction data stream based on the entity relationship network constructed from the transaction data stream and the role information in the user information to obtain desensitized data; trains a transaction risk identification model using federated learning based on the encrypted ciphertext and the desensitized data; determines the risk probability based on the acquired real-time transaction characteristics using the risk identification model; and generates a security control strategy based on the risk probability. By utilizing quantum encryption technology to protect data security and privacy, and generating precise security control strategies based on real-time transaction characteristics, comprehensive, real-time, and precise security control of transaction behavior is achieved, significantly improving the security, privacy, and reliability of transactions, and providing financial institutions with an effective risk prevention means.

[0118] The following describes an embodiment of the apparatus described in this application, which can be used to execute the big data transaction security management method in the above embodiments of this application. It is understood that the apparatus can be a computer program (including program code) running on a computer device, for example, the apparatus is an application software; the apparatus can be used to execute the corresponding steps in the method provided in the embodiments of this application. For details not disclosed in the apparatus embodiments of this application, please refer to the embodiments of the big data transaction security management method described above in this application.

[0119] Figure 3 A block diagram of a big data transaction security management system according to an embodiment of this application is shown.

[0120] Reference Figure 3 As shown, a big data transaction security management system according to an embodiment of this application includes:

[0121] The acquisition unit 310 is used to acquire user information and transaction data streams of both parties to the transaction, wherein the transaction data streams include structured and unstructured transaction data;

[0122] The encryption unit 320 is used to generate a dynamic quantum key from the polarization basis sequence selected by the two parties to the transaction, and to encrypt the transaction data stream using the dynamic quantum key to generate encrypted ciphertext.

[0123] The desensitization unit 330 is used to dynamically desensitize the user information and transaction data stream based on the entity relationship network constructed by the transaction data stream and the role information in the user information to obtain desensitized data;

[0124] Training unit 340 is used to train a transaction risk identification model based on the encrypted ciphertext and the de-identified data through federated learning.

[0125] The control unit 350 is used to determine the risk probability based on the acquired real-time transaction characteristics through the risk identification model, and generate a security control strategy based on the risk probability.

[0126] In this application, based on the aforementioned scheme, obtaining the user information and transaction data stream of both parties to the transaction includes: obtaining the user information and real-time transaction requests of both parties from a mobile application or POS terminal; and obtaining the transaction data stream from a payment platform. In this application, based on the aforementioned scheme, generating a dynamic quantum key from the polarization basis sequence selected by both parties to the transaction, and encrypting the transaction data stream using the dynamic quantum key to generate encrypted ciphertext includes: generating a dynamic quantum key from the polarization basis sequence selected by both parties to the transaction through quantum polarization state transmission; hashing the dynamic quantum key to generate hash parameters; and encrypting the transaction data stream using the hash parameters to generate encrypted ciphertext.

[0127] In this application, based on the aforementioned scheme, the dynamic desensitization of the user information and transaction data stream, based on the entity relationship network constructed from the transaction data stream and the role information in the user information, to obtain desensitized data, includes: parsing the data semantics based on the transaction data stream to construct an entity relationship network participating in the transaction; identifying the data sensitivity level based on the context information of the entity relationship network and the transaction data stream; generating a desensitization strength coefficient based on the role information in the user information and the data sensitivity level; and performing desensitization processing on the transaction data stream based on the comparison result between the desensitization strength coefficient and a set threshold to generate desensitized data.

[0128] In this application, based on the aforementioned scheme, the step of training a transaction risk identification model using federated learning based on the encrypted ciphertext and the de-identified data includes: decrypting the encrypted ciphertext to generate decrypted data; inputting the decrypted data and the de-identified data into a trusted execution environment, training a local model based on a loss function to generate local model weights; submitting the hash value of the local model weights to the blockchain in the trusted execution environment, and verifying the security of the local model weights by calling a verification function through a smart contract on the blockchain to obtain a first weight that has passed verification; aggregating the first weights to generate aggregate weights, and constructing a global risk identification model based on the aggregate weights.

[0129] In this application, based on the aforementioned scheme, the step of determining the risk probability through the risk identification model based on the acquired real-time transaction features, and generating a security control strategy based on the risk probability, includes: determining the data type corresponding to the acquired real-time transaction features; sending the real-time transaction features to the corresponding model according to the data type, and obtaining the output result of the corresponding model; processing the output result through a dynamic attention mechanism to generate the risk probability; and generating a security control strategy based on the risk probability.

[0130] In this application, based on the aforementioned scheme, the step of generating a security control strategy according to the risk probability includes: obtaining anomaly scores of historical behavior of transaction users; generating a comprehensive risk index and determining a dynamic risk level based on the risk probability, the transaction amount in the transaction data stream, and the anomaly scores; and selecting a security control strategy from a preset strategy library based on the dynamic risk level.

[0131] This application's technical solution acquires user information and transaction data streams from both parties in a transaction; generates a dynamic quantum key from the polarization basis sequences selected by both parties; encrypts the transaction data stream using the dynamic quantum key to generate encrypted ciphertext; dynamically desensitizes the user information and transaction data stream based on the entity relationship network constructed from the transaction data stream and the role information in the user information to obtain desensitized data; trains a transaction risk identification model using federated learning based on the encrypted ciphertext and the desensitized data; determines the risk probability based on the acquired real-time transaction characteristics using the risk identification model; and generates a security control strategy based on the risk probability. By utilizing quantum encryption technology to protect data security and privacy, and generating precise security control strategies based on real-time transaction characteristics, comprehensive, real-time, and precise security control of transaction behavior is achieved, significantly improving the security, privacy, and reliability of transactions, and providing financial institutions with an effective risk prevention means.

[0132] Figure 4 A schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application is shown.

[0133] It should be noted that the computer system of the electronic device in this embodiment is only an example and should not impose any limitations on the function and scope of use of the embodiments of this application.

[0134] In this embodiment, the computer system includes a central processing unit 401, which can perform various appropriate actions and processes based on a program stored in the read-only memory 402 or a program loaded from the storage section 408 into the random access memory 403, such as executing the big data transaction security management method described in the above embodiment. The random access memory 403 also stores various programs and data required for system operation. The central processing unit 401, the read-only memory 402, and the random access memory 403 are interconnected via a bus 404. An input / output interface 405 is also connected to the bus 404.

[0135] The following components are connected to the input / output interface 405: an input section 406 including a keyboard, mouse, etc.; an output section 407 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 408 including a hard disk, etc.; and a communication section 409 including a network interface card such as a LAN (Local Area Network) card, modem, etc. The communication section 409 performs communication processing via a network such as the Internet. A drive 410 is also connected to the input / output interface 405 as needed. A removable medium 411, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 410 as needed so that computer programs read from it can be installed into the storage section 408 as needed.

[0136] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program including a computer program for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 409, and / or installed from removable medium 411. When the computer program is executed by central processing unit 401, it performs various functions defined in the system of this application.

[0137] It should be noted that the computer-readable medium shown in the embodiments of this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying a computer-readable computer program. The transmitted data signal can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The computer program contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination thereof.

[0138] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. Each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0139] The units described in the embodiments of this application can be implemented in software or hardware, and the described units can also be located in a processor. The names of these units do not necessarily limit the specific unit itself.

[0140] According to one aspect of this application, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in the various alternative implementations described above.

[0141] In another aspect, this application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to implement the big data transaction security management method described in the above embodiments.

[0142] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of this application, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0143] Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, touch terminal, or network device, etc.) to execute the method according to the embodiments of this application.

[0144] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the embodiments disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein.

[0145] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method for security management and control of big data transactions, characterized in that, include: Obtain user information and transaction data streams from both parties to the transaction, wherein the transaction data streams include structured and unstructured transaction data; The polarization basis sequence selected by the two parties to the transaction is used to generate a dynamic quantum key, and the transaction data stream is encrypted using the dynamic quantum key to generate encrypted ciphertext. Based on the entity relationship network constructed from the transaction data stream and the role information in the user information, the user information and transaction data stream are dynamically de-identified to obtain de-identified data; Based on the encrypted ciphertext and the de-identified data, a transaction risk identification model is generated through federated learning. Based on the acquired real-time transaction characteristics, the risk probability is determined through the risk identification model, and a security control strategy is generated based on the risk probability. Specifically, a dynamic quantum key is generated from the polarization basis sequence selected by both parties to the transaction. This dynamic quantum key is then used to encrypt the transaction data stream, generating encrypted ciphertext, including: The polarization basis sequence selected by the two parties to the transaction is used to generate a dynamic quantum key through quantum polarization state transmission; The dynamic quantum key is hashed to generate hash parameters; The transaction data stream is encrypted using the hash parameter to generate encrypted ciphertext. for: in, This represents the hash parameter generated by hashing the key. Represents dynamic quantum key, Represents the transaction data stream. The error parameter represents the parameter that follows a Gaussian distribution. This represents the integer operation. This indicates the modulo operation.

2. The big data transaction security management method according to claim 1, characterized in that, The acquisition of user information and transaction data streams from both parties to the transaction includes: Obtain user information and real-time transaction requests from both parties in a transaction via mobile applications or POS terminals; Obtain transaction data streams from payment platforms.

3. The big data transaction security management method according to claim 1, characterized in that, The entity relationship network constructed based on the transaction data stream and the role information in the user information are dynamically de-identified to obtain de-identified data, including: Based on the transaction data stream, the data semantics are parsed to construct a network of relationships between entities participating in the transaction; Data sensitivity levels are identified based on the contextual information of the entity relationship network and the transaction data stream; Based on the role information in the user information and the data sensitivity level, a desensitization strength coefficient is generated; Based on the comparison between the desensitization intensity coefficient and the set threshold, the transaction data stream is desensitized to generate desensitized data.

4. The big data transaction security management method according to claim 1, characterized in that, The step of generating a transaction risk identification model based on the encrypted ciphertext and the de-identified data through federated learning includes: The encrypted ciphertext is decrypted to generate decrypted data; The decrypted data and the de-identified data are input into a trusted execution environment, and a local model is trained based on a loss function to generate local model weights. The hash value of the local model weight is submitted to the blockchain in the trusted execution environment. The verification function is called through the smart contract on the blockchain to verify the security of the local model weight and obtain the first weight that has passed the verification. The first weights are aggregated to generate aggregate weights, and a global risk identification model is constructed based on the aggregate weights.

5. The big data transaction security management method according to claim 1, characterized in that, The process of determining risk probability based on the acquired real-time transaction characteristics using the risk identification model, and generating a security control strategy based on the risk probability, includes: Based on the acquired real-time transaction characteristics, determine the data type corresponding to the real-time transaction characteristics; The real-time transaction features are sent to the corresponding model according to the data type, and the output results of the corresponding model are obtained; The output is processed using a dynamic attention mechanism to generate risk probabilities. A security management strategy is generated based on the stated risk probability.

6. The big data transaction security management method according to any one of claims 1-5, characterized in that, The generation of a security control strategy based on the risk probability includes: Obtain anomaly scores for historical behavior of trading users; Based on the risk probability, the transaction amount in the transaction data stream, and the anomaly score, a comprehensive risk index is generated to determine the dynamic risk level. Based on the dynamic risk level, a security control strategy is selected from a preset strategy library.

7. A big data transaction security management and control system, characterized in that, include: The acquisition unit is used to acquire user information and transaction data streams of both parties to the transaction, wherein the transaction data streams include structured and unstructured transaction data; An encryption unit is used to generate a dynamic quantum key from the polarization basis sequence selected by the two parties to the transaction, and to encrypt the transaction data stream using the dynamic quantum key to generate encrypted ciphertext; The desensitization unit is used to dynamically desensitize the user information and transaction data stream based on the entity relationship network constructed by the transaction data stream and the role information in the user information to obtain desensitized data; The training unit is used to train a transaction risk identification model based on the encrypted ciphertext and the de-identified data through federated learning. The control unit is used to determine the risk probability based on the acquired real-time transaction characteristics through the risk identification model, and generate a security control strategy based on the risk probability. Specifically, a dynamic quantum key is generated from the polarization basis sequence selected by both parties to the transaction. This dynamic quantum key is then used to encrypt the transaction data stream, generating encrypted ciphertext, including: The polarization basis sequence selected by the two parties to the transaction is used to generate a dynamic quantum key through quantum polarization state transmission; The dynamic quantum key is hashed to generate hash parameters; The transaction data stream is encrypted using the hash parameter to generate encrypted ciphertext. for: in, This represents the hash parameter generated by hashing the key. Represents dynamic quantum key, Represents the transaction data stream. The error parameter represents the parameter that follows a Gaussian distribution. This represents the integer operation. This indicates the modulo operation.

8. The big data transaction security management and control system according to claim 7, characterized in that, The acquisition of user information and transaction data streams from both parties to the transaction includes: Obtain user information and real-time transaction requests from both parties in a transaction via mobile applications or POS terminals; Obtain transaction data streams from payment platforms.

Images